2.6 KiB
Phase 1.0D early RetroArch diagnostic
retroarch_ps5_early_diag.elf is compile-time profile
PS5_PROFILE=early-diag with CHIMERA_PS5_EARLY_DIAG=1. It retains the real
RetroArch frontend, static chimera_smokecore, write firewall, bounded runtime,
W^X layout, reverse cleanup, no network, no content/configuration, no dynamic
core, no retry, no autoload, and _Exit.
Diagnostic ladder
The fixed D00-D12 ladder covers RetroArch main, platform begin/result, SDL begin/result, VideoOut open, buffers, first flip, Pad, AudioOut, core init, runloop, and shutdown. Each stage owns one bit in an in-memory attempted mask, so a notification is attempted at most once. Notification failure is recorded as a raw error and never blocks the primary path. Text is built in a fixed 192-byte buffer; truncation is counted and no dynamic formatting allocation is used. Login users are represented only by count and numeric IDs.
sceVideoOutSetBufferAttribute2 is void in the pinned SDL source. The
diagnostic stores CHIMERA_PS5_DIAG_NO_RETURN_VALUE; it does not fabricate a
success return. Consequently that exact boundary cannot receive a return-code
failure injection. Every representable boundary is injected by the host test.
Earliest frame
After VideoOut open, direct-memory allocation/mapping, equeue/event setup, and buffer registration—but before input, audio, core, and runloop—the SDL overlay writes a full magenta frame, a fixed white rectangle, and an embedded black pattern. It submits frame ID 0 once and waits once for at most 100,000 microseconds. A failed first flip records D07 and enters bounded teardown; it does not retry or initialize another buffer chain.
Source callsites are retroarch.c:6201 for D00 and the
PS5_PresentEarlyDiagnosticFrame hunk in
pkg/ps5/sdl2-ps5-early-diag.patch for the magenta frame. Disassembly binds
D00 at main+0xd (0x3ccd), the diagnostic frame helper at 0xfdf90, its
first-flip call at 0xfe1ec, the common notification call at 0x4776b, and
_Exit at 0x3cef.
Host fault model
ASan/UBSan host tests cover notification failure, truncation and duplicate
suppression; user-service failure and no-login-user; VideoOut open; direct
allocation/map; registration; equeue/event; first flip; Pad; AudioOut; core;
deadline; every cleanup boundary; the write firewall; stable D-code; and
exactly one selected _Exit path. No test result is hardware evidence.
Two clean target builds are byte-identical at 1,844,664 bytes and SHA-256
092bcabc0f8717a648030c592aa0dc900f878952fb14ee453851a29f298ea7ee.
Their map hash is
0d4d4614826fa4cbbf11e7374a2d2ecb574a00b55ad9deac17272f9504b254a0.
The artifact is execution_eligible=false.